It looks like your searches are well formatted already. Since you are running stats command, you should build a summary index with the sistats command. Other alternatives are to create and accelerated data models: http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Aboutdatamodels . This will help you to provide a fast and easy way to your management to build reports. ... View more

If you mean the log files in the filesystems, you can install a forwarder and threat it as a normal file. If instead these logs are inside the database, you should use the dbx app. ... View more

It will pick it up, as long as the recursive optiont is enabled and it matches the whitelist and blacklist ... View more

Try to multiply the value with an eval statement and use the new field instead ... View more

Try to add, under the stanza above, SHOULD_LINEMERGE=false ... View more

use . index=myindex | eval description= "my account".Account | table description ... View more

Make sure that only Apps compatible with SHC are installed. Any outcome from the ticket? ... View more

The release 6.2.1 contains improvement on the way this parameter is applied. So you might consider an upgrade: max_mem_usage_mb = < non-negative integer > **Provides a limitation to the amount of RAM a batch of events or results will use in the memory of search processes. **Operates on an estimation of memory use which is not exact. **The limitation is applied in an unusual way; if the number of results or events exceeds maxresults, AND the estimated memory exceeds this limit, the data is spilled to disk. **This means, as a general rule, lower limits will cause a search to use more disk I/O and less RAM, and be somewhat slower, but should cause the same results to typically come out of the search in the end. **This limit is applied currently to a number, but not all search processors. However, more will likely be added as it proves necessary. **The number is thus effectively a ceiling on batch size for many components of search for all searches run on this system. **0 will specify the size to be unbounded. In this case searches may be allowed to grow to arbitrary sizes. ... View more

You can search for that data across all time and indexes. If nothing returns the data has not been indexed. A very generic search is index=_ * OR index= * ... View more

You need to install the Hunk Application instead of Splunk to have the Virtual Indexes: http://www.splunk.com/download/hunk ... View more

index=_internal | head 5 | eval value=1 | eventstats sum(value) as total | streamstats window=0 sum(value) as sumvalue | eval percentage=(sumvalue*100/total) | table value,sumvalue,total,percentage value sumvalue total percentage 1 1 5 20 1 2 5 40 1 3 5 60 1 4 5 80 1 5 5 100 ... View more

I have reviewed this with jzhong ( original answer ) to provide a more detailed response. For the point 1 in Note section: "1. I attach the new Apple Push Notification certificate." you need to contat [email protected] Overview Mobile access server talks to Apple's push notification gateway via a binary interface using SSL. The SSL certificate required for these connections is obtained from Member Center. To make the push notification work for a re-signed iOS app, mobile access server needs to use a different SSL certificate provided by customer. Steps 1) Obtain a .p12 SSL certificate and a passphrase for communication with Apple's push notification gateway. Typically, this is a certificate used to talk to the production push notification gateway of Apple. You can find more details here: https://developer.apple.com/library/ios/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/Chapters/ProvisioningDevelopment.html#//apple_ref/doc/uid/TP40008194-CH104-SW1 I also found the descrption on this page quite extensive: http://www.raywenderlich.com/32960/apple-push-notification-services-in-ios-6-tutorial-part-1 2) Copy the .p12 certificate above to a certain location in your mobile access server, which the mobile access server has the permission to access. 3) In the MOBILE_ACCESS_SERVER_HOME/server/config/config_local.json file, create/modify the following JSON properties: { ... "ios": { "apn": { "${apn_env}": { "push_cert": "${/path/to/your/apn/ssl/certificate.p12}", "push_passphrase": "${your_apn_passphrase}" } } } ... } Here are three variables: 3.1) apn_env: It could be either "production" or "sandbox" depending on which push notification gateway you need to connect to. Typically it is "production". 3.2) "push_cert" value: it should be a path to your APN SSL certificate p12 file in step 2. 3.3) "push_passphrase" value: it should be the passphrase for the p12 certificate. 4) Once the change is done, restart your server. Notes I attach the new Apple Push Notification certificate. The v1 customer doesn’t need to update the /server/config/config_local.json. They can stop the mobile access server, then replace this p12 file, start the server again. It should work. ... View more